chinese_generic_botnet | 41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac

Analysis

max time kernel
150s
max time network
172s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-10-2023 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
Size

1.4MB
MD5

f83bf27e4cfc61bdbba4c1135445f489
SHA1

932b9e8cad438e56275010b72c1e861b63979ae8
SHA256

41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac
SHA512

2c3e9e84fbf2af5de4908f8cac944edf7f000b639a0f186181087b5db4d6e6a366ea9e76630e15e4f027e2bb5111325a0e1528b9161f54b4cdfb40a18f7bfaba
SSDEEP

24576:uJet4FsVtTGxj6BBczR2REOcrwCfGV7KF/bA639gw99jDesT9:2elVtTGJmcz4+r5fASElwnjfR

Score

10^/10

chinese_generic_botnet botnet persistence

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

resource	yara_rule
behavioral1/memory/2012-8701-0x0000000000400000-0x00000000005F7000-memory.dmp	unk_chinese_botnet

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\Ywcykeu.exe"	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs

pid	Process
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Ywcykeu.exe	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
File created	C:\Windows\Ywcykeu.exe	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2012	41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe

C:\Users\Admin\AppData\Local\Temp\41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe
"C:\Users\Admin\AppData\Local\Temp\41f6ce4a46570189b528ba60d65c8b910f4f80b97015bd6d6f94d9b76c9344ac.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2012-1-0x0000000075D50000-0x0000000075D97000-memory.dmp

Filesize
284KB

Download
memory/2012-812-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-811-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-816-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-814-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-818-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-820-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-822-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-824-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-830-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-828-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-826-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-836-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-834-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-832-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-842-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-840-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-838-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-844-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-846-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-848-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-850-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-852-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-854-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-856-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-858-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-860-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-862-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-864-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-868-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-866-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-870-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-872-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-2547-0x0000000002110000-0x0000000002291000-memory.dmp

Filesize
1.5MB

Download
memory/2012-8686-0x0000000002340000-0x0000000002451000-memory.dmp

Filesize
1.1MB

Download
memory/2012-8693-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2012-8701-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download